OpenSCAP/scap-security-guide — pull request #332 by iankko (2014-11-11 12:14:08+00:00)
Title: [RHEL/6] Add (RHEL-6) specific remediation for "Bind Mount /var/tmp To /tmp" rule

This proposal does the following:
* replaces 'mount_option_var_tmp_bind_var' rule name with 'mount_option_var_tmp_bind' (IOW unifies the ID so it would be the same for all of XCCDF, OVAL, & in remediation),
* adds RHEL-6 specific [*] remediation for "Bind Mount /var/tmp To /tmp" rule.

Testing report:
--
The change has been tested on RHEL-6 (in all scenarios /tmp placed on separate partition, /tmp placed within root partitition) & works as expected.

Notes for testing: Attempt of remediation returns 'error', but that's expected behaviour (since system must be rebooted first / before oscap can realize the property has been fixed, since OVAL checks /etc/mtab content for presence of 'bind' keyword, which won't be present there before / without reboot).

Please review.

Thanks, Jan.

[*] One note regarding the remediation being RHEL-6 specific yet - the OVAL check & provided remediation fix can't be shared, since on newer (RHEL-7 / Fedora) kernels there isn't 'bind' option present in /etc/mtab even with having the rule requested /var/tmp entry in /etc/fstab - FWICT some 'attr' parameter is added on RHEL-7 kernel. IOW the 'mount_option_var_tmp_bind' OVAL check first needs to be ported to RHEL-7/Fedora before it can be shared (will file a ticket for this shortly).